PT-2025-30271 · Sophos · Sophos Firewall

Name of the Vulnerable Software and Affected Versions: Sophos Firewall versions prior to 21.0 MR2 21.0.2 Description: An arbitrary file writing vulnerability exists in the Secure PDF eXchange SPX feature. This can lead to pre-authentication remote code execution when SPX is enabled with a specifi...

PT-2025-30340 · Romm · Romm

Name of the Vulnerable Software and Affected Versions: RomM versions 4.0.0-beta.3 and below Description: RomM is a tool that allows users to manage their game collections. An authenticated arbitrary file write issue exists in the /api/saves endpoint. This can lead to Remote Code Execution. The...

PT-2025-30328 · Luxcal · Luxcal

Name of the Vulnerable Software and Affected Versions: Luxcal version 4.5.2 Description: A reflected cross-site scripting XSS vulnerability exists in index.php that allows an unauthenticated attacker to steal other users' data. Recommendations: Update to a newer version that contains a fix for th...

PT-2025-30269 · Sophos · Sophos Firewall

Name of the Vulnerable Software and Affected Versions: Sophos Firewall versions prior to 21.0 MR1 21.0.1 Description: A post-authentication SQL injection vulnerability exists in the WebAdmin component. Successful exploitation can potentially allow administrators to achieve arbitrary code executio...

PT-2025-30344 · Hax Cms · Hax Cms

Name of the Vulnerable Software and Affected Versions: HAXcms versions prior to 11.0.7 Description: HAXcms with a nodejs backend allows users to start the server in any HAXsite or HAXcms instance. The NodeJS version of HAXcms, in versions 11.0.6 and below, uses an insecure default configuration...

PT-2025-30194 · Instantbits · Instantbits Web Video Cast App

Name of the Vulnerable Software and Affected Versions: InstantBits Web Video Cast App versions up to 5.12.4 Description: A vulnerability exists in the InstantBits Web Video Cast App for Android, related to the improper export of android application components through manipulation of the...

PT-2025-30414 · Tenda · Tenda Ac7

Name of the Vulnerable Software and Affected Versions: Tenda AC7 version 15.03.06.44 Description: A critical issue exists in the httpd component of Tenda AC7. The vulnerability is due to a stack-based buffer overflow in the formSetMacFilterCfg function within the /goform/setMacFilterCfg file. The...

PT-2025-30189 · Unknown · Zavy86 Wikidocs

Name of the Vulnerable Software and Affected Versions: Zavy86 WikiDocs versions through 1.0.78 Description: A vulnerability exists in Zavy86 WikiDocs, potentially allowing for cross site scripting. The issue is located in the file template.inc.php and involves manipulation of the path argument. T...

PT-2025-30109 · WordPress · Epay.Bg Payments

Name of the Vulnerable Software and Affected Versions: EPay.bg Payments plugin for WordPress versions up to and including 0.1 Description: The EPay.bg Payments plugin for WordPress is susceptible to Stored Cross-Site Scripting through the plugin’s epay shortcode. Insufficient input sanitization a...

PT-2025-30112 · WordPress · Partnerský Systém Martinus Plugin

Name of the Vulnerable Software and Affected Versions: Partnerský systém Martinus plugin for WordPress versions up to and including 1.7.1 Description: The Partnerský systém Martinus plugin for WordPress is susceptible to Stored Cross-Site Scripting through the plugin’s martinus shortcode...

PT-2025-30126 · WordPress · Simple Backup

Name of the Vulnerable Software and Affected Versions: Simple Backup versions prior to 2.7.11 Description: The Simple Backup plugin for WordPress is vulnerable to Arbitrary File Download due to a lack of capability checks and file type validation in the download backup file function. This allows...

PT-2025-29985 · WordPress · Wp Knowledgebase

Name of the Vulnerable Software and Affected Versions: Knowledge Base plugin for WordPress versions prior to 2.3.2 Description: The Knowledge Base plugin for WordPress is susceptible to Stored Cross-Site Scripting via the plugin slug setting due to insufficient input sanitization and output...

PT-2025-30051 · Melange · Melange

Name of the Vulnerable Software and Affected Versions: melange versions 0.23.0 through 0.29.4 Description: melange allows users to build apk packages using declarative pipelines. SBOM files generated by melange in apks had file system permissions mode 666, potentially allowing an unprivileged use...

PT-2025-29990 · WordPress · Aapanel Wp Toolkit

Name of the Vulnerable Software and Affected Versions: aapanel WP Toolkit versions 1.0 through 1.1 Description: The aapanel WP Toolkit plugin for WordPress is susceptible to privilege escalation due to missing authorization checks within the auto login function. Authenticated attackers with...

PT-2025-29987 · WordPress · Plugin Pengiriman Woocommerce Kurir Reguler

Name of the Vulnerable Software and Affected Versions: Plugin Pengiriman WooCommerce Kurir Reguler, Instan, Kargo – Biteship versions through 3.2.0 Description: The Plugin Pengiriman WooCommerce Kurir Reguler, Instan, Kargo – Biteship for WordPress is susceptible to an Insecure Direct Object...

PT-2025-29999 · WordPress · Woocommerce Refund/Exchange With Rma - Warranty Management

Name of the Vulnerable Software and Affected Versions: WooCommerce Refund And Exchange with RMA - Warranty Management, Refund Policy, Manage User Wallet versions up to and including 3.2.6 Description: The WooCommerce Refund And Exchange with RMA - Warranty Management, Refund Policy, Manage User...

PT-2025-30050 · Apko · Apko

Name of the Vulnerable Software and Affected Versions: apko versions 0.27.0 through 0.29.4 Description: apko is a tool that allows users to build and publish OCI container images built from apk packages. In versions prior to 0.29.5, critical files were inadvertently set to 0666, which could...

PT-2025-29994 · WordPress · Vertical Scroll Image Slideshow Gallery

Name of the Vulnerable Software and Affected Versions: Vertical scroll image slideshow gallery plugin for WordPress versions prior to 11.2 Description: The plugin is susceptible to Stored Cross-Site Scripting through the width parameter due to inadequate input sanitization and output escaping. Th...

PT-2025-30086 · Hotelmis · Hotelmis

Name of the Vulnerable Software and Affected Versions: cgpandey hotelmis versions prior to c572198e6c4780fccc63b1d3e8f3f72f825fc94e Description: A problematic issue exists in the admin.php file's HTTP GET Request Handler component. Manipulation of the Search argument can lead to cross-site...

PT-2025-29997 · WordPress · Testimonial Post Type Plugin

Name of the Vulnerable Software and Affected Versions: Testimonial Post type plugin for WordPress versions prior to 1.2.2 Description: The Testimonial Post type plugin for WordPress is susceptible to Stored Cross-Site Scripting through the auto play parameter. Insufficient input sanitization and...